fix(ci): pin CML binary instead of unauthenticated setup-cml

[TimeToBuildBob]

Problem

Master Comment is red on run 35805105352 (setup-cml: API rate limit exceeded for the runner IP). Build, Lint, and CodeQL on the same SHA (c8c0306) are green.

#981 passed GITHUB_TOKEN into iterative/setup-cml, but that action constructs Octokit with token: instead of auth:, so the lookup stays unauthenticated and still burns the shared 60/hour IP quota. Same error on run 35345893651 (2026-09-18).

Fix

Stop calling the GitHub releases API. Download a checksummed cml-linux-x64 from iterative/cml v0.20.6 (current latest, already what version: latest resolved to) and put it on PATH.

Verification

• Workflow YAML parses.
• Local sha256 of the v0.20.6 linux-x64 asset matches the pin.
• The installed binary exposes cml publish and cml comment create.

[TimeToBuildBob]

Review guide (auto-posted)

Structured warm-up for reviewers — what changed, what to run, where to look.

Key files

• .github/workflows/comment.yml (+13/-5, Δ18)

Suggested verification

• Run the repo's usual CI-equivalent checks locally

Known risks / watch points

• No automatic high-risk tags; use file list + diff for judgment.

Suggested review focus

• Confirm behavior matches the PR description acceptance criteria.
• Skim the largest diffs first (listed above).
• If CI is green, spot-check the highest-risk paths called out here.

Generated by scripts/github/pr-warmup-review-guide.py for #994.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the replacement installation preserves the workflow's required CML functionality while avoiding the unauthenticated releases API lookup.

Summary

This PR replaces the rate-limit-prone setup-cml action with direct installation of a versioned, checksum-verified CML binary.

• Pins CML to v0.20.6 for the workflow's fixed x64 Linux runner.
• Verifies the binary's SHA-256 digest before making it executable.
• Adds the installation directory to subsequent steps through GITHUB_PATH.
• Preserves support for the existing cml publish and cml comment create calls.

_{Reviews (1) · Last reviewed commit: "fix(ci): pin CML binary instead of unaut..."}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.66%. Comparing base (c8c0306) to head (30e3168).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #994   +/-   ##
=======================================
  Coverage   57.66%   57.66%           
=======================================
  Files          51       51           
  Lines        3231     3231           
  Branches      754      754           
=======================================
  Hits         1863     1863           
  Misses       1352     1352           
  Partials       16       16           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[TimeToBuildBob]

CI-green and mergeable — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.